Hackers have obtained counterfeit TLS certificates for Google and other large online services, according to a report published by Ars Technica. The unauthorized certificates were acquired following the compromise of three domain registries.

TLS certificates are the credentials that underpin secure, encrypted connections across the web. They are the mechanism that allows browsers to confirm that a user is connecting to the genuine version of a website rather than an impostor, and they enable the padlock icon that signals an encrypted connection.

According to Ars Technica, the compromise of the three domain registries allowed the attackers to walk off with the unauthorized certificates. Because certificates are issued based on proof of control over a domain, gaining access to registry systems can give attackers a path to obtaining credentials they should not be able to acquire.

Counterfeit certificates for high-profile services such as Google are significant because they can potentially be used to impersonate trusted sites. In principle, a certificate that a browser accepts as valid could help an attacker intercept or redirect traffic that users believe is secure.

The Ars Technica report identifies the root cause as the registry compromise but focuses on the fact that unauthorized certificates were successfully obtained for Google and other large services. Further technical details beyond the registry compromise and the resulting counterfeit certificates were not provided in the available source.